Get started

PostgreSQL FIPS  is an advanced object-relational database management system that supports an extended subset of the SQL standard, including transactions, foreign keys, subqueries, triggers, user-defined types and functions. This build of PostgreSQL uses OpenSSL and the pgcrypto PostgreSQL extension to achieve FIPS compliance with its cryptographic library.

Refer to the PostgreSQL reference guide for the Helm chart documentation and all standard configuration options. This guide focuses on the FIPS-specific aspects of the Helm chart.

Before exploring the chart’s possibilities, let’s start by deploying a basic configuration:

helm install <release-name> oci://dp.apps.rancher.io/charts/postgresql-fips \
    --set global.imagePullSecrets={application-collection}

Container overview

The PostgreSQL FIPS container image is a modified version of the standard PostgreSQL container image. The key differences are:

• FIPS-validated OpenSSL: The container runs OpenSSL in FIPS mode, restricting all cryptographic operations to FIPS 140-3 approved algorithms.
• pgcrypto extension: The pgcrypto PostgreSQL extension is pre-installed and enabled by default, exposing FIPS-validated cryptographic functions from OpenSSL directly within the database.

Any documentation for the standard PostgreSQL container applies to this image as well, with the FIPS-specific behavior described in this guide. You can check the official PostgreSQL documentation  and the pgcrypto extension documentation.

Find the latest PostgreSQL FIPS container artifacts in Application Collection .

pgcrypto extension

This container image includes and enables the pgcrypto extension for the default database that is created when deploying PostgreSQL, and it will not be enabled by default in any other databases in the PostgreSQL server. You can run the following command within your PostgreSQL command-line to check whether it is enabled in the current database:

SELECT fips_mode();

If you see the following output, it means that the extension is active in your current database and FIPS mode is enabled:

 fips_mode
-----------
 t
(1 row)

On the other hand, if you see the following error, it means that the extension is not active in your current database:

ERROR:  function fips_mode() does not exist
LINE 1: SELECT fips_mode();
               ^
HINT:  No function matches the given name and argument types. You might need to add explicit type casts.

You can enable the pgcrypto PostgreSQL extension by executing the following command:

CREATE EXTENSION IF NOT EXISTS pgcrypto;

FIPS compliance

FIPS 140-3 defines which cryptographic algorithms are approved for use. When PostgreSQL operates in FIPS mode:

• All cryptographic operations are delegated to OpenSSL, which uses only FIPS-approved algorithms.
• Non-FIPS algorithms such as MD5 or Blowfish are disabled at the OpenSSL level.
• The pgcrypto extension operates with pgcrypto.builtin_crypto_enabled = fips, routing all crypto through OpenSSL rather than pgcrypto’s built-in implementations.

Authentication

Because MD5 is not a FIPS-approved algorithm, the md5 client authentication method is not available. Use scram-sha-256 instead when configuring pg_hba.conf or via the POSTGRES_HOST_AUTH_METHOD environment variable.

Verify FIPS mode

After starting the container, connect to the database and run the following checks to confirm FIPS mode is operating correctly.

• Confirm FIPS mode is active:

  SELECT fips_mode();

  Expected output:

   fips_mode
  -----------
   t
  (1 row)

  If this command fails or throws an unexpected error, you must enable the pgcrypto extension in your current database.

• Confirm pgcrypto uses FIPS-validated crypto:

  SHOW pgcrypto.builtin_crypto_enabled;

  Expected output:

   pgcrypto.builtin_crypto_enabled
  ---------------------------------
   fips
  (1 row)

• Confirm the SSL library is OpenSSL

  SHOW ssl_library;

  Expected output:

   ssl_library
  -------------
   OpenSSL
  (1 row)

• Verify that algorithms forbidden by FIPS, like MD5 or Blowfish (bf), are disabled

  The following queries should fail, confirming that MD5 is correctly blocked:

  SELECT md5('foo');

  Expected output:

  ERROR:  could not compute MD5 hash: unsupported

  and

  SELECT crypt('my_secure_password', gen_salt('bf', 8));

  Expected output:

  ERROR:  use of non-FIPS validated crypto not allowed when OpenSSL is in FIPS mode

• Verify that FIPS-approved algorithms work:

  SELECT encode(digest('foo', 'sha256'), 'hex');

  Expected output:

                                encode
  ------------------------------------------------------------------
   2c26b46b68ffc68ff99b453c1d30413413422d706483bfa0f98a5e886266e7ae
  (1 row)

Chart configuration

The PostgreSQL FIPS Helm chart is based on our PostgreSQL Helm chart, without any meaningful differences except the Helm chart name, version, and the FIPS-enabled container images used. For more information on how to use and operate this Helm chart, refer to the PostgreSQL Helm chart documentation.

Limitations

• MD5 is disabled: Any operation relying on MD5 — including the md5() function, pg_hba.conf md5 authentication, and the pgcrypto MD5 digest — will fail with an error.
• Non-FIPS crypt algorithms are disabled: pgcrypto functions such as crypt() with Blowfish (bf) salt and other non-approved algorithm combinations are not available.
• Host-level FIPS enforcement: FIPS mode must also be enabled in the host system that runs the container for full end-to-end compliance. If you are using SUSE Linux Enterprise, follow this guide  to enable strict FIPS mode.
• No implicit FIPS certification: Running this container image or Helm chart means using a FIPS-validated cryptographic module (OpenSSL), but it does not constitute formal FIPS certification of the database instance without completing an official certification process.